[eluser]llbbl[/eluser]
there is nothing wrong with it. if your so concerned about direct access change 'inc' to 'supersecretblahblahneverguessfoldername'.
the full path is.
/system/application/views/inc/header.html
if your using CI everyone knows where your views and controllers reside.
/system/application/views/welcome_message.php
When you try to load a view directly by url (/system/application/views/foobar.php) with a common header you will get a fatal error.
Fatal error: Using $this when not in object context
Otherwise the file will look like a blank page without any data in it. All your <?php echo $whatever; ?> won't show up in the html.
Its actually very helpful if you have a site with more than 5 pages that have similar header or footer.